CVE-2024-11302

{"id": "CVE-2024-11302", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 2.5}]}, "published": "2025-03-20T10:15:25.003", "references": [{"url": "https://huntr.com/bounties/e341304b-4651-4de9-b7b9-b89aead3b46e", "source": "security@huntr.dev"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-304"}]}], "descriptions": [{"lang": "en", "value": "A missing check_access() function in the lollms_binding_infos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /install_binding and /reinstall_binding endpoints, among others, enabling unauthorized access and manipulation of binding settings without requiring the client_id value."}, {"lang": "es", "value": "La falta de la funci\u00f3n check_access() en el m\u00f3dulo lollms_binding_infos del repositorio parisneo/lollms (versi\u00f3n V14) permite a los atacantes a\u00f1adir, modificar y eliminar enlaces arbitrariamente. Esta vulnerabilidad afecta a los endpoints /install_binding y /reinstall_binding, entre otros, lo que permite el acceso no autorizado y la manipulaci\u00f3n de la configuraci\u00f3n de enlaces sin necesidad del valor client_id."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "security@huntr.dev"}